Say I have the following workflow to deploy a new version of my webapp. It's a small app so all the build + deploy work is done on the same server (example.co
)
- A user executes
git push
which pushes new code up to my server (example.co
) - The server has a bare git repository which receives the changes. It kicks off a
post-receive
hook - The post-receive hook runs a build script which builds a new docker container and starts it up
The git repository is managed by a dedicated git
user on my server. This is so that any developer can add a git remote ssh url like ssh://[email protected]:/some/path.git
and push up to it using SSH
The build and deploy work is done by a deploy
user since this requires sudo
permission.
How do I have my git
user kick off a script as the deploy
user? Should the git user even have any way to do that, because anyone could ssh into the machine under the git
user right?
Is there a better way to segment these permissions?
Thanks!